WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 51–100 of 181 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.4 Medium Membership Plugin – Restrict Content Plugin restrict-content Cross-Site Scripting Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings ≤ 3.2.18 CVE-2026-1304 Wordfence
4.3 Medium WCFM Membership – WooCommerce Memberships for Multivendor Marketplace Plugin wc-multivendor-membership Broken Access Control WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment ≤ 2.11.8 CVE-2025-15147 Wordfence
5.4 Medium Simple Membership WP user Import Plugin simple-membership-wp-user-import Cross-Site Request Forgery No login needed ≤ 1.9.1 Fixed in 1.9.2 CVE-2026-24986 Patchstack
5.4 Medium WP-Members Membership Plugin wp-members Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Checkbox and Multiple Select User Profile Fields ≤ 3.5.4.3 CVE-2025-14448 Wordfence
5.4 Medium User Registration & Membership Plugin user-registration Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Post Deletion No login needed ≤ 4.4.8 CVE-2025-14976 Wordfence
5.3 Medium WP-Members Membership Plugin wp-members Information Disclosure Unauthenticated Information Exposure via Unprotected Files No login needed ≤ 3.5.4.4 CVE-2025-12648 Wordfence
6.4 Medium Membership Plugin – Restrict Content Plugin restrict-content Cross-Site Scripting Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes ≤ 3.2.15 CVE-2025-14000 Wordfence
5.3 Medium Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member Information Disclosure User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure No login needed ≤ 2.11.0 CVE-2025-12492 Wordfence
6.4 Medium User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Plugin user-registration Cross-Site Scripting Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 4.4.6 CVE-2025-13367 Wordfence
4.3 Medium ARMember Plugin armember-membership Broken Access Control Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin <= 3.4.10 - Broken Access Control ≤ 3.4.10 Fixed in 3.4.11 CVE-2022-47425 Patchstack
5.3 Medium CRM Memberships Plugin crm-memberships Broken Access Control Missing Authorization to Unauthenticated 'ntzcrm_add_new_tag' AJAX Action No login needed ≤ 2.5 CVE-2025-13312 Wordfence
5.3 Medium Subscriptions & Memberships for PayPal Plugin subscriptions-memberships-for-paypal Other Unauthenticated Fake Payment Creation No login needed ≤ 1.1.7 CVE-2025-12752 Wordfence
5.3 Medium Subscriptions & Memberships for PayPal Plugin subscriptions-memberships-for-paypal Broken Access Control No login needed ≤ 1.1.7 Fixed in 1.1.8 CVE-2025-66107 Patchstack
4.4 Medium MembershipWorks Plugin memberfindme Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting ≤ 6.14 CVE-2025-12018 Wordfence
5.3 Medium Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Broken Access Control Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal No login needed ≤ 2.16.4 CVE-2025-11835 Wordfence
6.5 Medium SUMO Memberships for WooCommerce Plugin sumomemberships Broken Access Control Arbitrary Content Deletion ≤ 7.8.0 Fixed in 7.8.0 CVE-2025-52757 Patchstack
5.3 Medium Login with YourMembership - YM SSO Login Plugin login-with-yourmembership Broken Access Control YM SSO Login <= 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moym_display_test_attributes' No login needed ≤ 1.1.7 CVE-2025-10648 Wordfence
6.4 Medium Team Members Plugin team-members Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.3.5 CVE-2025-8440 Wordfence
5.5 Medium WP-Members Plugin wp-members Cross-Site Scripting ≤ 3.5.4.2 Fixed in 3.5.4.3 CVE-2025-57973 Patchstack
5.3 Medium Memberful - Membership Plugin memberful-wp Broken Access Control No login needed ≤ 1.75.0 Fixed in 1.76.0 CVE-2025-58000 Patchstack
6.5 Medium StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More Plugin storeengine Path Traversal Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Download ≤ 1.5.0 CVE-2025-9215 Wordfence
5.0 Medium WP-Members Membership Plugin wp-members Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names ≤ 3.5.4.2 CVE-2025-9489 Wordfence
6.5 Medium UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP Plugin userswp SQL Injection Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection ≤ 1.2.44 CVE-2025-10003 Wordfence
4.9 Medium User Registration & Membership Plugin user-registration SQL Injection Authenticated (Admin+) SQL Injection ≤ 4.3.0 CVE-2025-9085 Wordfence
5.9 Medium GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership Plugin gourl-bitcoin-payment-gateway-paid-downloads-membership Cross-Site Scripting ≤ 1.6.6 CVE-2025-48102 Patchstack
6.5 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Arbitrary Shortcode Execution ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 4.16.4 CVE-2025-8878 Wordfence
5.4 Medium WP Membership Plugin wp-membership Broken Access Control Settings Change ≤ 1.6.3 Fixed in 1.6.4 CVE-2025-54717 Patchstack
6.4 Medium WP-Members Plugin wp-members Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.5.4.1 CVE-2025-7495 Wordfence
4.3 Medium MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Plugin paid-membership Cross-Site Request Forgery Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset No login needed ≤ 3.2.0 CVE-2025-5937 Wordfence
6.5 Medium WP-Members Plugin wp-members Cross-Site Scripting ≤ 3.5.4 Fixed in 3.5.4.1 CVE-2025-50051 Patchstack
5.9 Medium Simple Membership Plugin simple-membership Cross-Site Scripting ≤ 4.6.3 Fixed in 4.6.4 CVE-2025-49333 Patchstack
6.4 Medium WP-Members Plugin wp-members Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode ≤ 3.5.2 CVE-2025-4610 Wordfence
4.8 Medium Team Members Showcase Plugin wps-team Cross-Site Scripting Editor+ Stored XSS < 4.4.2 Fixed in 4.4.2 CVE-2024-9236 WPScan
6.1 Medium MemberSpace – Membership Plugin and Paid Subscriptions Plugin Cross-Site Scripting Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSS No login needed < 2.1.14 Fixed in 2.1.14 CVE-2024-13727 WPScan
5.3 Medium User Registration & Membership – Custom Registration Form, Login Form, and User Profile Plugin user-registration Broken Access Control Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion No login needed ≤ 4.2.1 CVE-2025-3281 Wordfence
6.4 Medium Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder Plugin wps-team Cross-Site Scripting Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.4.1 CVE-2025-3521 Wordfence
4.3 Medium User Registration & Membership PRO – Custom Registration Form, Login Form, and User Profile Plugin Cross-Site Request Forgery Custom Registration Form, Login Form, and User Profile <= 5.1.3 - Cross-Site Request Forgery to User Deletion No login needed ≤ 5.1.3 CVE-2025-3284 Wordfence
6.5 Medium Membership For WooCommerce Plugin membership-for-woocommerce Cross-Site Scripting ≤ 2.8.0 Fixed in 2.8.1 CVE-2025-39579 Patchstack
5.3 Medium User Registration & Membership – Custom Registration Form, Login Form, and User Profile Plugin user-registration Broken Access Control Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification No login needed ≤ 4.1.3 CVE-2025-3282 Wordfence
4.3 Medium User Registration & Membership – Custom Registration Form, Login Form, and User Profile Plugin user-registration Broken Access Control Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update ≤ 4.1.3 CVE-2025-3292 Wordfence
6.5 Medium BuddyPress Members Only Plugin buddypress-members-only Cross-Site Scripting ≤ 3.5.3 Fixed in 3.6.3 CVE-2025-31812 Patchstack
6.5 Medium Team Members for Elementor Page Builder Plugin team-members-for-elementor Cross-Site Scripting ≤ 1.0.4 CVE-2025-31771 Patchstack
4.3 Medium Our Team Members Plugin our-team-members Information Disclosure Sensitive Data Exposure ≤ 2.2 Fixed in 2.3 CVE-2025-30802 Patchstack
6.5 Medium MicroPayments Plugin paid-membership Cross-Site Scripting ≤ 2.9.29 Fixed in 2.9.30 CVE-2025-31075 Patchstack
6.1 Medium User Registration & Membership – Custom Registration Form, Login Form, and User Profile Plugin user-registration Cross-Site Scripting Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting No login needed ≤ 4.0.4 CVE-2025-1511 Wordfence
4.3 Medium Subscriptions & Memberships for PayPal Plugin subscriptions-memberships-for-paypal Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Post Deletion No login needed ≤ 1.1.6 CVE-2024-13560 Wordfence
5.3 Medium SureMembers Plugin suremembers-core Information Disclosure Sensitive Information Exposure No login needed ≤ 1.10.6 CVE-2024-12434 Wordfence
6.1 Medium s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions Plugin s2member Cross-Site Scripting Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site Scripting No login needed ≤ 241216 CVE-2024-11376 Wordfence
4.3 Medium Team – Team Members Showcase Plugin tlp-team Broken Access Control Team Members Showcase Plugin <= 4.4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Update ≤ 4.4.9 CVE-2024-13439 Wordfence
5.3 Medium Membership Plugin – Restrict Content Plugin restrict-content Information Disclosure Restrict Content <= 3.2.13 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure No login needed ≤ 3.2.13 CVE-2024-11090 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only